JA EN
shiichan

No way — Cloudflare WAF now auto-blocks brand-new Nuxt and Fastjson RCEs!

Cloudflare Changelog ★★★ View Markdown
#cloudflare#security

Hey there, it's me, Shii-chan! I found a Cloudflare security update today and couldn't help leaning forward — WAF just started blocking some freshly discovered RCE vulnerabilities!

Cloudflare Changelog developers.cloudflare.com

What was announced?

Cloudflare's Changelog posted a WAF managed ruleset update dated 2026-07-29. This release adds new rules that detect traffic targeting a vulnerability in Nuxt's Server Island component and one in Alibaba Fastjson's deserialization routine. It also strengthens detection for SSRF (Server-Side Request Forgery) aimed at cloud metadata, and for obfuscated command injection attempts.

Here are the three things worth paying attention to.

  • Nuxt Server Island - RCE (GHSA-9473-5f9j-94wq): An unauthenticated vulnerability. Attackers can supply arbitrary component names or props to an endpoint, which lets them achieve remote code execution on the server
  • Alibaba Fastjson JSONType Remote Code Execution: An unauthenticated RCE affecting Fastjson 1.2.83 and below. Even under default configurations, attackers can run arbitrary system commands, bypassing traditional classpath- and gadget-based defenses
  • Generic SSRF and command injection protections: The detection logic for SSRF against cloud-hosted apps was improved, and a new rule was added to catch obfuscated command injection patterns across request parameters

The story so far

Until now, the SSRF - Cloud - Beta rule was set to Log only. Suspicious traffic got written to logs but wasn't automatically blocked. There wasn't a dedicated rule for obfuscated patterns like the one Command Injection - Obfuscation now targets, either. And since the Nuxt Server Island and Fastjson RCEs are fairly recently discovered vulnerabilities, the managed ruleset didn't have dedicated detection for them yet.

What changes

This update completely changes how dangerous traffic gets handled.

  • SSRF - Cloud - Beta switched from Log to Block. Suspicious SSRF traffic no longer just gets logged — it gets blocked on the spot
  • Command Injection - Obfuscation, Alibaba Fastjson JSONType Remote Code Execution - Body, and Nuxt Server Island - RCE were all added as new rules, set to Block from day one
  • Generic Rules - RCE, Generic Rules - XSS, and File Upload - RCE were also added as new generic rules, also set to Block
  • Even better: those three generic rules ship not just in the Cloudflare Managed Ruleset but in the Cloudflare Free Ruleset too. So Free plan users get this baseline protection right away as well

If your team runs a web app behind Cloudflare, these rules apply automatically without you changing any settings. If your backend runs on Nuxt or Fastjson, this update should be a real relief.

Dive Deep

Let me break down the new and changed rules in a bit more detail.

Changes to the Cloudflare Managed Ruleset:

  • SSRF - Cloud - Beta (rule ID ending c2e84e2d): Log → Block. An existing rule with improved detection
  • Command Injection - Obfuscation (rule ID ending 761e7a4c): Log → Block. A new detection
  • Alibaba Fastjson JSONType Remote Code Execution - Body (rule ID ending 7347c892): Log → Block. A new detection
  • Nuxt Server Island - RCE (rule ID ending 8ec012ea): N/A → Block. A new rule — it looks like this used to be lumped into Generic Rules - RCE and has now been split out
  • Generic Rules - RCE (rule ID ending 3590a4ad): N/A → Block. A new rule
  • Generic Rules - XSS (rule ID ending 9c6dff1c): N/A → Block. A new rule
  • File Upload - RCE (rule ID ending 3a5b40d6): N/A → Block. A new rule

Rules added to the Cloudflare Free Ruleset:

  • Generic Rules - RCE (rule ID ending cfe1a93c): N/A → Block
  • Generic Rules - XSS (rule ID ending 9ab5ed95): N/A → Block
  • File Upload - RCE (rule ID ending 1b7f9c67): N/A → Block

Here's how the source describes the Fastjson vulnerability:

Under default configurations, attackers can execute arbitrary system commands, bypassing traditional classpath and gadget-based defenses.

Since even a default configuration can be exploited around traditional defenses like classpath restrictions and gadget-chain blocking, teams running Fastjson 1.2.83 or below should also consider reviewing their version. As for Nuxt Server Island, the issue comes from a design where component names and props get passed straight through to server-side processing — so if your Nuxt app uses Server Islands, it's worth checking.

Wrap-up

  • New rules now block traffic targeting Nuxt Server Island - RCE (GHSA-9473-5f9j-94wq) and Alibaba Fastjson JSONType RCE (1.2.83 and below)
  • The SSRF - Cloud - Beta rule was upgraded from Log to Block, so it now actually blocks traffic
  • A new rule was added to detect obfuscated command injection
  • The generic Rules - RCE / XSS and File Upload - RCE rules also apply to Free Ruleset users

This is an update you shouldn't skip if you're running web apps or server-side APIs behind Cloudflare — especially if your team builds on Nuxt or Fastjson!

Related posts